make keypairs for secure ble

Makefile

@@ -1,6 +1,6 @@
 IMAGE=./target/riscv32imc-unknown-none-elf/release/ecu-esp32
 
-$(IMAGE): $(wildcard ecu-esp32/src/*.rs) Makefile pubkey.bin ecu-esp32/Cargo.toml Cargo.toml
+$(IMAGE): $(wildcard ecu-esp32/src/*.rs) Makefile pubkey.bin ecu-esp32/Cargo.toml Cargo.toml keys/device.key keys/client.pub
 	echo $<
 	cargo build --release
 
@@ -16,8 +16,18 @@ ota: ota.bin
 install: $(IMAGE)
 	espflash flash  --erase-parts otadata --partition-table ./partitions.csv --monitor --chip esp32c3  $<
 
+# these keys are used during normal operation for signing session requests and
+# OTA updates
 privkey.pem:
 	openssl genpkey -algorithm ed25519 -out privkey.pem
 
 pubkey.bin: privkey.pem
 	openssl pkey -in $< -pubout  -text_pub | awk '/^ / {print}' | xxd -r -p > $@
+
+# these keys are used during wifi provisioning so we can authenticate
+# the peer
+keys/client.key keys/client.pub:
+	python genkeys.py keys/client.key
+
+keys/device.key keys/device.pub:
+	python genkeys.py keys/device.key

genkeys.py

@@ -0,0 +1,17 @@
+import nacl
+from pathlib import Path
+from nacl.public import PrivateKey, Box
+import sys
+
+secret = PrivateKey.generate()
+public = secret.public_key
+
+sk_filename = Path(sys.argv[1])
+sk_filename.parent.mkdir(exist_ok=True)
+
+with open(sk_filename, "w") as f:
+    f.buffer.write(secret.encode(encoder=nacl.encoding.RawEncoder))
+
+pk_filename = sk_filename.with_suffix(".pub")
+with open(pk_filename, "w") as f:
+    f.buffer.write(public.encode(encoder=nacl.encoding.RawEncoder))